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Abstract. Let ip : E E' he a.n isogeny of prime degree £ between elliptic curves 
defined over a number field. We describe how to perform (/s-descents on the nontrivial 
elements in the Shafarevich-Tate group of E' which are killed by the dual isogeny (p' . 
This makes computation of ^-Selmer groups of elliptic curves admitting an ^-isogeny 
over Q feasible for ^ = 5, 7 in cases where a iy9-descent on E is insufficient and a full 
^-descent would be infeasible. As an application we complete the verification of the 
full Birch and Swinnerton-Dyer conjectural formula for all elliptic curves over Q of 
rank zero or one and conductor less than 5000. 



1. Introduction 

Let E/k be an elliptic curve over a number field k. The Mordell-Weil group E{k) 
of rational points on E is known [231 EO] to be a finitely generated abelian group. Let 
L{E/k,s) be the Hasse-Weil L-function of E. When /c = Q it is known [SU H] to be 
an entire function on the complex plane. Its order of vanishing at s = 1 is called the 
analytic rank, denoted ran(-E'/Q). Birch and Swinnerton-Dyer have conjectured [2] that 
rank(E(Q)) = ran(^/Q), that the Shafarevich-Tate group UI{E/Q) is finite and that 
its order is related to the leading term of the Taylor expansion of L{E/Q,s) at s = 1 
by a formula recalled below. 

For any i > 2, the Mordell-Weil and Shafarevich-Tate groups are also related by an 
exact sequence of finite abelian groups 

^ E{k)/iE{k) Sel^^\E/k) m{E/k)[i] . 

The middle term is the i-Selmer group of E. Its computation is referred to as an i- 
descent on E. This gives an unconditional bound on the Mordell-Weil rank or, when 
the rank is known (e.g. for elliptic curves over Q of analytic rank or 1), information 
on the ^-torsion in the Shafarevich-Tate group. A detailed description of how to do an 
^-descent when £ is a prime is given in In practice, ^-descents typically require class 
and unit group information in an extension of k obtained by adjoining the coordinates 
of one or more nontrivial points in E[i]. So, even over Q, £-descents are not usually 
feasible for primes larger than 3. 
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When E admits an isogeny ip : E ^ E' of degree i one can compute Selmer groups 
associated to ip and the dual isogeny ip'. The two are related by a 5-term exact sequence 
(see (I2.2p below), which often allows one to compute the full £-Selmer group. The 
advantage to this approach is that, generically, a full ^-descent would require working 
with an extension of degree i'^ — i (assuming E admits an ^-isogeny), whereas the ip- and 
(^'-Selmer groups can be determined from class and unit group information in extensions 
of degree In many cases, the ip- and (^'-Selmer groups can actually be determined 

with very little explicit computation. For details in various specific cases, the reader 
may wish to consult [H El [T31 [HI HZJ EZl EBl EH] • General treatments are given in 
and [22j, the latter also containing a recent and rather thorough review of the existing 
literature. The disadvantages are that this does not apply to general elliptic curves 
and that, even when it does, it may fail to yield sufficient information to compute the 
£- Selmer group. 

The latter issue can be dealt with if one can determine the subgroup 

vmE/k)[e])cm{E'/kW]. 

In principle this can be achieved by computing the Cassels pairing |S] on in.{E' / k)[{p'] x 
UI{E' /k)[ip']. When E[i] ~ Z/iZ x as a Galois module, the pairing can be evaluated 
by writing it as a sum of local pairings [15j. However, such splittings do not occur 
generically; over Q this is only possible for i < 5. In general one can try to reduce to 
the split case by passing to an appropriate extension [151 Section 2.5], but there is no 
guarantee that this will yield the required information over Q. 

In this paper we give an alternative method for computing the subgroup ip {in.{E/k) [i]), 
analogous to the approach for computing £^-Selmer groups developed in [HIDJJ. Given 
C G UIlE' / k)[ip'] we compute a finite set, called the ip-Selmer set of C, which consists 
of certain everywhere locally solvable coverings of C. This set is nonempty precisely 
when C admits a lift to UI{E/k)[i]. We refer to our method as a second ip-descent. 
Together with ip- and (^'-descents on E' and E, this always allows one to determine the 
£-Selmer group. All of the descents involved require class and unit group information 
in extensions of degree at most i, making computation of £-Selmer groups of general 
elliptic curves admitting an ^-isogeny over Q feasible in practice for £ = 5,7. 

As an application we complete the proof of the following theorem. 

Theorem 1.1. Let E be an elliptic curve over Q of conductor N < 5000 and such that 
ran{E/Q) < 1. Then the full Birch and Swinnerton-Dyer conjecture holds for E. This 
means that ran{E/Q.) is equal to the rank of E{Q), UI{E/Q) is finite and that 

L^-\E/q, 1) m) ■ YIM^) ■ Reg(i^(Q)) • #m(E/Q) 

where Cp{E) denotes the Tamagawa number at the prime p, Reg(£'(Q)) is the regulator 
of E and Q{E) is the integral over E(M.) of the absolute value of the minimal invariant 
differential of E. 
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Several remarks are in order. Firstly we note that the bound of 5000 on the conductor 
is an arbitrary one, but it seemed to provide a good balance between challenge and 
feasibility. The restriction on the rank is less so. If rg^^{E/Q) < 1 then it is known 
[m [311 E] that ran(^/Q) is equal to the rank of E{Q) and m{E/Q) is finite. However, 
there is no curve of rank greater than one for which III(i^^/Q) is known to be finite. 
The rank conjecture has been verified by John Cremona [9] for many individual curves 
with ran(-E'/Q) < 3, in particular for all curves of conductor up to 130,000. Thus the 
hypothesis in Theorem 1 1 . 1 1 1 hat ri^^{E/Q) < 1 can be stated in terms of the algebraic 
rank instead. However, there is no curve of algebraic rank greater than three for which 
the rank conjecture is known, as there is no known method for proving that the analytic 
rank is what it appears to be in such cases. 

Theorem 11.11 extends the efforts begun in [TH] , where the authors proved the ^-part 
of BSD (i.e. the claim that the order of ni(i?/Q) predicted by the formula is a rational 
number and that the exponent of i in its prime factorization is the same as the expo- 
nent of the actual order of UI{E/Q)) for such curves of conductor up to 1000 without 
complex multiplication, for i = 2 and for i such that the mod-i Galois representation 
attached to E is irreducible and i f Ylp'^pi^)- W^ the second author extended this 
to such curves of conductor up to 5000 for £ = 2,3 and for all £ > 5 such that the 
mod-i representation is irreducible, regardless of complex multiplication or Tamagawa 
numbers. 

The restriction to irreducible mod i representations above owes itself to a result of 
Kolyvagin [19] which allows one to obtain upper bounds for ord£(#ni(i?/Q)) through 
suitable Heegner index computations. Neither Kolyvagin's original result nor any of its 
various extensions (e.g. [HI 3.2 - 3.5] or [211 5.1 - 5.4]) yield effective upper bounds 
when E has CM and reducible mod i representation or when i \ #-E'(Q)tors for some 
Q-isogenous curve E'. The remaining CM curves were dealt with in [22] by means of 
£-isogeny descent, using knowledge of class groups of cyclotomic fields to avoid much 
of the explicit computation. In the remaining cases i \ #-E'(Q)tors! so £ < 7. For the 
majority of these the ^-primary part of HI was computed in [T^ [T3] by an £-isogeny 
descent. However, for the eleven pairs {E,i) listed in Tabled] (the first entry in each 
pair is an isogeny class labeled as in the Cremona database [9]), this was insufficient. 
We use second £-isogeny descents to compute 'ni{E/Q)[i°°] for these 11 remaining cases 
and complete the proof of Theorem 11.11 

Remark 1.2. Some of the 11 pairs in Tabled] may have been handled independently 
by other authors using alternative means. We note in particular that (5701,5) has been 
dealt with by computation of the Cassels-Tate pairing [151 sec. 2.5]. 

1.1. Organization. Section [2] gives definitions and basic properties of the ip-coverings 
we aim to compute. In Section |3] we define a descent map which ultimately gives 
a more concrete realization of these abstractly defined objects. We then develop a 
cohomological description of the descent map and use this to derive several important 
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Table 1. Remaining isogeny classes 



E 


£ 


E i 


546f 


7 


1938j 


5 


5701 


5 


1950y 


5 


858k 


7 


2370m 


5 


870i 


5 


2550be 


5 


1050o 


5 


3270h 


5 


1230k 


7 







properties in Section HI In Section [5] we show how to write down explicit models in 
projective space for the coverings parametrized by our descent. In particular, this gives 
an explicit inverse to the descent map. 

In Section [6] we give an algorithm for computing the (y9-Selmer set of an element 
in III (ii^'//c )[(/)]. With the material of the preceding sections this is a rather standard 
reduction to computational algebraic number theory. Following this we introduce a 
fake Selmer set which is easier to compute, but may differ from the genuine Selmer set 
slightly. We conclude with the proof of Theorem 11.11 and some explicit examples. In 
two of these we use a second £-isogeny descent to determine the ^-primary part of the 
Shafarevich-Tate group with £ = 5 or 7. In a third, we give an example where a second 
isogeny descent is needed to compute the analytic order of III. Namely, we find a gener- 
ator of the Mordell-Weil group of canonical height approximately 242 by writing down 
an explicit model for a degree 25 covering of E^ and use this to compute the regulator. 
This last example makes essential use of recent work by Fisher on minimization and 
reduction of genus one normal curves of degree 5 [l6j . 

1.2. Notation. Throughout I will denote an odd prime, n will denote an integer and 
K will denote a perfect field of characteristic not dividing ni with algebraic closure 
K and with absolute Galois group Gk- The symbol k will denote a number field; the 
completion of at a prime v will be denoted k^. 

For a projective curve C jK and a commutative i^-algebra A we use C ®k-A to denote 
the extensions of scalars C Xspeci^- Spec A. In the special case that A = K this will also 
be denoted by C . The function field of C is denoted k(C). We use Div(C) to denote the 
group of K-rational divisors on C. If P G CiK^ is a point, the corresponding divisor 
in Div(C') will be denoted [P]. The quotient of Div(C) by the subgroup of i^-rational 
principal divisors is denoted by Pic(C). The group of i^-rational divisor classes on C is 
Pic(C')'^^. We remind the reader that the obvious map Pic(C) Pic(C')*^^^ is injective, 
but may fail to be surjective. 
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2. 99-coVERlNGS 

A K-torsor under is a smooth, projective curve C /K together with algebraic group 
action oi E ow C which is defined over K and is simply transitive on ^-points (we will 
always assume the action of E is fixed even if it is not explicitly given in the notation) . 
Any point P G C{K) gives an isomorphism (defined over the field of definition of P) 
ipp : C c:^ E sending a point Q G C{K) to the unique R G E{K) such that Q = P + R. 
We say that an isomorphism of curves ip : C E is compatible with the torsor structure 
if it is of this type. The X-isomorphism classes of X-torsors under E are parameterized 
by the Weil-Chatelet group, lV-{K,E). A X-torsor under E is trivial (i.e. isomorphic 
to E acting on itself by translations) if and only if it has a X-rational point. Hence, for 
a number field k, the Tate-Shafarevich group, 

m{E/k)^kej:(l{\k,E)^^R\k^,E)^ , 

parameterizes isomorphism classes of everywhere locally solvable torsors. 

Definition 2.1. Let be an isogeny of elliptic curves defined over K of degree 

not divisible by the characteristic of K, and let C be a /T-torsor under E'. A (p-covering 
of C is a morphism of curves D ^ C defined over K which fits into a commutative 
diagram 




where -^c and %1)d are isomorphisms of curves defined over with ijjc compatible with 
the torsor structure on C. Two (/^-coverings of C are isomorphic if they are X-isomorphic 

as C-schcmcs. The set of all ii'-isomorphism classes of (y9-covcrings of C defined over 
K is denoted by Coy^'^\CIK). \i K = k is a number field, wc define the ip-Selmer set 
of C, denoted Sel^'^-*(C/A;), to be the set of all isomorphism classes of (^-coverings of C 
which are everywhere locally solvable. 

Since the possible choices for ipc differ by translations and (/? is surjective on K- 
points, all (^-coverings of C are ^-isomorphic as C-schemes. Geometrically they are 
Galois coverings of C with group isomorphic to E[ip]. So by the twisting principle 
Cov^'^\C/K) is, if nonempty, a principal homogeneous space for B.^(K, E[ip]), with the 
action given by twisting. Every (/p-covering D ^ C comes equipped with the structure 
of a i^'-torsor under E. Indeed, any isomorphism ipo as in the definition gives an action 
oi E on D via D x E 3 {Q,P) ^ '4'd^{'4'd{Q) + P) E D. The isomorphism class of 
the torsor does not depend on ipD as we have assumed that ipc is compatible with the 
torsor structure on C. 
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The map ip : E ^ E' gives E the structure of a (y^-covering of E' (considered as the 
trivial torsor). Considering the elements of Coy'^'^\E' / K) as twists of this canonical ele- 
ment gives a canonical identification Com^'^\E' / K) = R^K, E[^]). Thus, Com^'^\E'/K) 
is an abelian group. 

The y9-Selmer set is finite and, at least in principle, computable [7]. We refer to its 
computation as a (^-descent on C . This also applies when C = E'. In this case the 
y9-Selmer set is a finite abelian group, and it sits in an exact sequence 

(2.1) E'{k)/ifE{k) Sel^'^\E'/k) ^ UI{k,E)[if] 

(see [2Sl Theorem X.4.2]). 

Remark 2.2. The reader is cautioned that the middle term in (12.11) is almost always 
referred to as the (y9-Selmer group of E (with E rather than E' present in the notation). 
This is reasonable given that it is a subgroup of H^(fc, £'[(/?]). However, we find it 
convenient to adopt this nonstandard notation since in our interpretation of coverings 
it is the codomain of the covering map which plays the primary role. 

Our interest in (y9-descents stems from the following relation to (/^-divisibility in the 
Shafarevich-Tate group. 

Lemma 2.3. Suppose C is a k-torsor under E' defined over a number field k. Then 
C G ipm{E/k) if and only zf Se\^'^\C / k) ^ 0. 

Proof. We may assume C G UI{E'/k), otherwise the statement is trivial. Suppose C is 
killed by n and consider the following commutative diagram. 

Sel("°^)(E7/t) ^ m{E/k)[n o ^] ^ 



Sel^^'^E'/k) m{E'/k)[n] 

By the exact sequence (12.11) . C admits a lift to an n-covering C ^ E' in the n-Selmer 
group of E'. Each choice of lift gives a map Se\^'^\C/k) 3 {D,p) i— )• {D,n o p) G 
Sei(-°^)(^'/A;). The image of this map is exactly the fiber above (C, tt) under the map 
denoted ip^, in the diagram above. From this one deduces the result from commutativity 
and the fact that the horizontal maps are surjective. □ 

The dual isogeny ip' : E' ^ E satisfies ip o ip' = (\eg[ip>). There is also a Selmer group 
associated to ip' . It is related to the (p- and deg(v9)-Selmer groups by the 5-term exact 
sequence [26], Lemma 6.1], 



<p(ni(B/*:)|deg(<p)]) 
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It is also worth noting that the order of Sel*-''' \E/k) can be computed from the order of 
using a formula of Cassels in [6], and vice versa. Lemma [231 shows that one 
can compute the final term in (12. 2p by doing (^-descents on the elements of III (£"/ A;) [</)']. 
Together with the (p- and (^'-descents on E' and E, this allows for computation of the 
deg((y9)-Selmer group. Since the elements of IH^E' /k)[ip'] would presumably be obtained 
by the yj'-descent on E we refer to this as a second isogeny descent on E. 

Remark 2.4. For C G UI{E'/k) it is well known that the condition in Lemma [2.31 is 
equivalent to requiring that C pair trivially with all elements of UI{E' / k)[ip'] under the 
Cassels pairing defined in [5]. The fact that the pairing is alternating implies that the 
order of the final term in (12. 2p is a square whose prime factors divide deg{ip). 

2.1. ^-isogeny coverings. For the remainder of the paper we assume that deg{(p) is 
an odd prime i and let C be a (/^'-covering of an elliptic curve E defined over K. 
By definition there is an isomorphism ipc : C c:^ E' such that n = (f' o ip^, which gives 
C the structure of a /T-torsor under E'. Let X = 7i~^{0e) denote the set of points 
lying above the identity on E. The action of E' on C restricts to an action of E'[(p'] 
on X. Moreover, 7r*[0£;] is a i^-rational divisor of degree i on C. The linear system 
corresponding to vr*[0£;] gives an embedding of C in P^~^ as a genus one normal curve of 
degree £. We remind the reader that a genus one normal curve of degree n > 3 defined 
over K is a smooth projective curve of genus one embedded in P"~i via the complete 
linear system associated to some ii'-rational effective divisor of degree n (see [101 I, 
Section 1.3]). 

If D A C is a yj-covering of C, then composing the covering maps gives D the 
structure of ^-covering of E. This results in a map (which depends on both C and the 
map tt) 

: Cov('^)(C/i^) ^ Gom^^\E/K) ~ Yi\K,E[(]) . 

Definition 2.5. We define Co\^^\ClK) C Cov^*^) (C/K) to be the subset consisting 
of elements such that '^-,^{0) is self orthogonal with respect to the Weil-pairing cup 
product 

U£ : Yi\K,E[£]) X Yi\K,E[£]) -A Yi^ {K , E[l] ® E[i]) ^ ^^{K,^i^) = Bt{K)[£] . 

Remark 2.6. Equivalently, Covl^\C / K) is the set of isomorphism classes of y^-coverings 
which map via \E'^ into the kernel of the obstruction map, Ob^ : H^(i^, E[i]) — )■ Br(i^), 
considered in [10]. Indeed, it is known that Ob^ is quadratic and that the associated 
bilinear form is the cup product figuring in our definition. 

If A; is a number field and D G CoY^'^\C/k) is everywhere locally solvable, the local 
global principle for the Brauer group of k shows that D G Covq'^''(C/A;). In other words, 
Sel(^)(C/A;) C Cov[,^)(C/A;). 

We also have a geometric description of CovQ'^''(C/i^'). 
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Lemma 2.7. Let D e Goy^'^\C/K). Then D e Covi^\C/K) if and only if there is a 
model for D as a genus one normal curve of degree I in P^"-*^ defined over K with the 
property that the pull-hack of any x & X G C is a hyperplane section. 

Proof. Fix isomorphisms ipn : D ^ E and ipc '■ C E' (defined over K) such that the 
diagram 




commutes. The ^-covering {D,7t o p) is self orthogonal with respect to the Weil pairing 
cup product if and only if ijj'^[£[OE]) is linearly equivalent to some ii'-rational divisor 
(see [ID], [11]). On the other hand, D admits a model as in the statement of the lemma 
if and only if p*[x] is linearly equivalent to some i^'-rational divisor, for each x E X. 
It thus suffices to show that for all x E X, ipD{i[OE]) and p*[x] are hnearly equivalent. 
For this we may work geometrically. The problem is then equivalent to showing that 
for any (/^'-torsion point P G E'[ip'], the pull-back of P under ip is linearly equivalent to 
^[O^;]. This follows from the well-known fact that two divisors on an elliptic curve are 
linearly equivalent if and only if they have the same degree and the same sum. Indeed, 
the divisors in question both have degree £ and sum to 0^; in the group E{K). □ 



3. The Descent Map 

In this section we define a map on Cov^q\c / K) taking values in a quotient of the 
multiplicative group of a certain etale i^-algebra. Ultimately we will see that this map is 
injective. Its image gives a concrete realization of Coy'^q\C / K) which is more amenable 
to computation. 

3.1. G/^-sets and etale algebras. Recall that C A is a (/^'-covering of E and 
X = tc'^IOe) is a torsor under E'[(p']. Define Y to be the set of divisors on C, 

Y = {{£ - 2)[x] + [x + P] + [x - P] e Div(C) : xeX, Pe E'[ip']/{±1} } . 

Then F is a Gx-set of hyperplane sections of C C P^~^ that are supported entirely 
on X. Use F = Map^(X, ^) and H = Map^(F, ^) to denote the etale i^-algebras 
corresponding to X and Y. We will identify K with the subalgebras of constant maps 
in F and in H. The action of Gk on Y is determined by the action of Gk on X. This 
induces a 'norm map,' 

d:F = Map^(X, K)3ip^ l{y = J2 W) ^ H '^(^)"^ ) ^ Map^(r, K) = H . 

\ xgx xex / 
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As a Gx-set, Y splits as the union of (at least) the two G^-stable subsets, 
Fi = {i[x] : xeX}, 

Y2 = {{i-2)[x] + [x + P] + [x-P] : xeX,Oj^Pe E'[^']} . 

This gives rise to a splitting of H a.s H c:^ Hi x H2 := Mapj^lYi, K) x Map^(l2, -S'). 
As Gii-sets Yi and X are isomorphic, so we may identify Hi with F. The 'norm map' 
d also splits as d = (di, 82), where 9i : F 3 a 1— i- G F ~ i^i and 82 : F ^ H2. 

Remark 3.1. For £ = 3, X is a set of three colinear points on C C and Y2 is a 
singleton containing the line through these three points. The map 82 '■ F ^ H2 is the 
usual norm Np/^ : F ^ K. 

3.2. The descent map. Let [x] G Div(C ®k F) = Map^(X, Div(C)) denote the map 
X ^ [x]. Similarly define [y] G Div(C ®k H) = Map;^(F, Div(C)) to be [y] : y ^ 
y. Choose a linear form [ G H[ui, . . . ,U£] cutting out the divisor [y]. This means 
that [ is a Galois equivariant family of linear forms parametrized by the Gx-set Y, 
with the property that evaluating the coefficients of 1 at ?/ G F yields a linear form 
ly G K[ui, . . . ,ue] defining the hyperplane section y G Div(C'). Note that under the 
splitting, if ~ F X 7^2, we have [ = ([1,12) and the divisor defined by li is ^[x]. 

Lemma 3.2. Let d = X]p^p[-P] ^ Div(C) be any K-rational divisor on C with support 
disjoint from X . 

(1) Evaluating 1 on d gives a well defined element {{d) := Y\p l(P)"^ G H^ / . 

(2) [ induces a unique homomorphism 

I : Pic(C) ^ TT^J^ . 

with the property that for all d as above, the image of the class of d is equal to 
the class of l{d) . 

Remark 3.3. Results of this type are well known. This particular statement is a special 
case of [m Proposition 3.1] (or [12, Proposition 2.1]). 

Proof. If K' / K is any extension and h G k(C ®k K')^ is a rational function, then the 
rule 

d = Y^ npP ^ h{d) = Yl h^Pyp G K"" . 

defines a homomorphism from the group of i^'-rational divisors with support disjoint 
from the support of div(/i) to K'^ . Given d as in the statement we can choose a linear 
form u G K[ui, . . . , m^] such that d and the hyperplane section defined by u have disjoint 
supports. Then i/u n{C ® H) is a Galois equivariant family of rational functions. 
The corresponding homomorphisms patch together to give a homomorphism from the 
group of ii"-rational divisors with support disjoint from X and the support of div(-u) 
to H^ . Modulo the choice for u we get a well defined homomorphism from K-rational 
divisors with support disjoint from X to H^ / . This proves the first statement. 
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For the second, define 

[ : Pic(C) ^ 



by setting the value of I on S G Pic(C) equal to the class of l{d), where d G Div(C) 
is any i^'-rational divisor representing H with support disjoint from X. If this is well- 
defined, then it is clearly the unique homomorphism with the stated property. That 
such d exists follows from [201 page 166] where it is shown that any i^'-rational divisor 
class which is represented by a i^'-rational divisor contains a ii'-rational divisor avoiding 
a given finite set. 

Next we use Weil reciprocity to show that the result does not depend on the choice 
for d. Let h G k{C)^ be any rational function whose zeros and poles are disjoint from 
X and choose a linear form u G K[ui, . . . ,ue] whose corresponding divisor has support 
disjoint from X and the support of div(/i). Weil reciprocity gives 

V(.))^/.(div(i))^W,^. 

u V V""/ / n[aw{u)) 

Define a G Mapj^{X, K^) = hj a : X 3 x h{x) G . Now consider 
d{a) G Map^(F,ir>^) = H"" . The value of d{a) at y = E^^W ^ F is 

d{a)y = \{a{xY^ = \{h{xr^ = h{y) = /i(div([,)) . 

This shows that h{V) = d{a) G d{F^). On the other hand, h{dw{u)) clearly lies in . 
So ^(div(/i)) G K^dF^ which shows that the homomorphism is well defined. □ 

It is worth noting that for a point P G C{K) \ X, the image of the class of [P] in 
Pic(C) under this homomorphism is given by evaluating [ on any choice of homogeneous 
coordinates in K for P. In general one must use the moving lemma to find a linearly 
equivalent divisor with support disjoint from X. We will abuse notation slightly by 
writing l(P) for the image of the class of [P]. 

Proposition 3.4. The choice of [ induces a well defined map 



KxdPx ' 

with the property that if {D,p) G Cov^q''\C/K) and K G K' is any extension of fields 
with Q G D{K'), then 

p)) = l{p{Q)) mod K'^'diF^KKY . 

Proof. Let {D, p) G Cav^^\C / K). By Lemma l2n we have a model for (D, p) as a genus 
one normal curve of degree ^ in P^~^ = ¥^^^{zi : ■ ■ ■ : Zi) such that the pull-back of 
any x G X is a hyperplane section of D, defined by the vanishing of some linear form 
G K[zi, . . . , Ze]. Moreover, these hx may be chosen so that they patch together to 
give a hnear form t) G F[zi, . . . ,ze] cutting out the divisor p*[x] on D (^k F. Since the 
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zero divisor of [ is [y] = (9[x] G Div(C H) we see that (9f) and I o p cut out the same 
divisor on D. Hence there exists some A E such that 

(3.1) [op = A-a[), 

in the homogeneous coordinate ring of D ®k H. We define $((-D, p)) to be the class of 
A in / K^dF^ . Note that a different choice for f) would alter A by an element of 
K'^dF''. 

Let us show that this does not depend on the model. Suppose (D', p') is isomorphic 
to {D,p). As above let f) G F[zi, . . . ,zg\ be a linear form cutting out the divisor p*[x] 
on D ®K F . By assumption we have an isomorphism of coverings ip : D' ^ D defined 
over K (i.e. such that p' = poip). In the coordinate ring of D' ®k H we have 

(3.2) A • 9([i o ^) = ^*(A9[)) = ^*([ op) = [opo^ = [op'. 

The divisor on D' cut out by o is p'*[x], so the extremal terms in (13. 2 p define the 
image of {D' , tt') under the descent map. Thus the image of {D', n') is also the class of 
A, which shows that $ is well-defined. 

It remains to show that $ has the stated property. For this let Q G D{K'). There 
exists a ii"'-rational divisor d = riiQi on D linearly equivalent to [Q] and such that 
the support of d contains no points lying above X. The divisor [p((5)] on C is linearly 
equivalent to the i^'-rational divisor p^d := (^-S- |2B1 II. 3. 6]). So [(p(Q)) is 

represented by \.{p^d). On the other hand, the relation (13. ip defining A gives, \.{p^d) = 
A ■ di){d), since deg(rf) = 1. Now since d is if '-rational, dl){d) G K'^9(F K'Y . So 
{{p{Q)) is represented by A as required. □ 

3.3. Image of the descent map. Recall that we identify K with the constant maps 
in F and H. Under this identification we have d{a) = a^, for all a E K. Thus 
K'^ C dK^ C dF^. We define a subgroup 

(3.3) «?.^ttc 



K^dF^ K^dF^ ' 
and a subset 

_ {{{P) ■ dF^'f" 
^3-4) '^K ^x^^x ' 

where P G C{K) is any point. 

The defining property of $ and the next lemma show that the image of $ is contained 
in Hk- Ultimately we will see that Hk is equal to the image of $. 

Lemma 3.5. Hk does not depend on the choice for P G C{K). 

Proof. Let P' G C{K) and choose some {D,p) G CoY^f^\C/K). Fix a model for D in 
P^^^ as above and let f) be a linear form with coefficients in F defining the divisor p*[x]. 
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Then, for some A G , we have \ o p = Ad^ in the coordinate ring of D H. If 
Q, Q' are points of D lying above P and P', we have 

i{P) _ dm -fi(^iQ)\rBF- 

i{p') am) Wq')) ■ 

This shows that the coset l(P) • dF^ does not depend on P. The same holds for its 
Gi<:-invariant subset, which proves the lemma. □ 

The next lemma shows that non membership in I-Lk is stable under base change. 

Lemma 3.6. Suppose that K' is an extension of K and A e is such that A ®k 1 
represents a class in T-Lr'- Then the class of A in / K^dF^ lies in UK- 
Proof. The assumptions imply that in {H (g)^ K') ^ we have 

A 



1 — da , 



l(P) 

for some a G (P (g)^ K')^ ~ Haiex -^'^ depending on P G C{K). For a; G X we have 
^x/'^x{P) = af. in K'. This shows that is algebraic over K, and hence lies in K. 
Thus a e F and we have A = l{P)d{a) in H. This shows that A represents a class in 
Kk. □ 



4. Towards Cohomology 

4.1. AfRne maps. We say that a map f : X ^ is affine if 

for all X G X and P, Q G E'^], f{x + P) • f{x + Q) = f{x) -fix + P + Q). 
An easy calculation shows that this is actually equivalent to the a priori weaker condition 

for all X G X and P G E'[ip'], f{x + P) • f{x - P) = f{xf . 
This results in the following. 

Lemma 4.1. A map a G fJ^e{F) = Map(X, /x^) is affine if and only if 82(0:) = 1. 

Proof, a lies in the kernel of 82 if and only if for every y — [£—2)[x] + [x+ P] + [x — P] G I2 
we have a{xY~'^a{x + P)a{x — P) = 1. □ 

Let AS{X,fi£) denote the Gi^-module of affine maps from X to /j.^. Given an affine 
map a G AS{X,fii) and a; G X, projecting onto the linear part gives a well defined 
homomorphism (P 1— )■ a{x + P)/a{x)) G B.om{E'[ip'], pi). Since a is affine this does not 
depend on the choice for x E X,so we get a morphism of Gi^-modules A : Aff (X, Hi) — > 
}iom{E'[ip'], fii) whose kernel consists of the constant maps. Using the </7-Weil pairing 
we have an identification 

(4.1) E[<p] 3P^ e^(P, •) G Hom(£;'[(^'], /x^) . 
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This gives an exact sequence of Gi^-modules 

(4.2) 1 ^ /i^ -> Aff(X,/i,) ^ Hom(E' /i,) = E[ip] ^0. 

Taking Galois cohomology of (14. 2p and identifying H^(i^', jjLi) with Br(fr)[£], we obtain 
the following exact sequence 

(4.3) H^(ir,^,) ^ Hi(ir,Aff(X,/x,)) ^ }l\K,E[v]) ^ Bi{K)[l] . 



Lemma 4.2. There is an isomorphism 

(4.4) $o:ker(T):.A__L_ = H^. 

Proof. Lemma [4.11 gives a morphism of short exact sequences, 

(4.5) 1 -1 



1 Afr(X, fie) dF"" 1 



where the copies of are embedded as the constant maps. Taking Galois cohomology 
gives a morphism of long exact sequences, 

1 fie{K) i^x ^ i^x }l\K, fie) il\K, K^) = 



1 Afr^(X,/i,) (9FX)G, ^ll\K,AS{X,fie)) ^}1'{K,F^) = 0, 

where the equalities follow from Hilbert's Theorem 90. From this we see that IS 
isomorphic to the quotient of H^(ir, Aff (X, fii)) by the image of H^(fs:,^^). On the other 
hand, the latter is isomorphic to the kernel of T by exactness of (14. 3p . □ 

For any Xq G X we can use the y^-Weil pairing to define a map 

E[(p] X X 3 {P,x) e^{P, X- xo) e fii. 

A different choice of Xq gives a map which differs by a constant. Nondegeneracy of the 
Weil pairing shows that we have a well defined embedding 

(4.6) E[^] 3P^ e^(P, X - Xo) G fii{F)/fie . 

The following lemma gives an alternative description of this embedding. 

Lemma 4.3. Let D e_CoY^^\C / K) ^NB; over K , not K) and let t) denote a linear form 
(with coefficients in F) defining the pull-back of [x]. For any P G E[ip], the image of 
P under the composition E[(p] ^ fii{F)/ fie F'^ /K^ is equal to the class of ^^^^j^^; 
where Q E D is any point chosen so that \){Q) and f)(P + Q) are both defined and 
invertible in F. 
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Proof. Fix isomorphisms ipD '■ D ^ E and ip : C ^ E' (defined over K) such that the 
diagram 

p 




commutes. Let Xq be the preimage of 0^;/ under and let Qq be any preimage of 
Xq under p. If x G X, evaluating the coefficients of f) at a: gives a linear form 
defining the pull-back of [x\ by p. Consider the function h^/hx^ G n{D)^ and its 
image = {i)]^^)* {h^ / K^) e k{EY . The divisor of K/K^ is P*H - P*[xq], so by 
commutativity div{gx) = '■P*[{x — Xq)] — ip*[QE']- By definition of the yj-Weil pairing 
III.8, exer. 3.15], for any P G ^[(^], 



e^{P, X - xq) 



9.{R) 



where R E E is any point chosen so that both numerator and denominator are defined 
and nonzero. Thus, we have 



(4.7) 



e^{P,x - xo) 



hx{p+rDmh.MD\R)) 



K{^^\R))K,{P + iji\R))- 

Considered as an element of = Map(X, modulo the constant maps, the right- 
hand side of ( 14. 7p is represented by the map 

hiP + i;^\R)) _(^ _ hx{P + rD\R)) \ 



h{rn\R)) 



X H-> 



On the other hand, the left-hand side of (14. 7p represents the image of P in p^{F)/ ji^, 
so we are done. □ 



4.2. Some diagrams. The maps in (14. 2 p and (14. 6 p fit together to give a commutative 
and exact diagram: 

(4.8) 



Hi 



Aff(X,^,) ^p,{F) 



d2 



111 



d2 



1 



1 
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Taking Galois cohomology and making the identifications described below yields an- 
other commutative and exact diagram: 



(4.9) 



Kk 



-1/0 
Hk 



92,* 



KK Hi(ir, E[^]) U\K, 



92,. 



T 



BT{K)[i] 



and 



Kk 



where the map pr^^ is induced by the projection pr^^ 

H°(X,92W(^)) 

The bottom row of (14. 9p is obtained directly by taking Galois cohomology of the 
bottom row of fl4.8p . Using Hilbert's Theorem 90 we may identify the quotient of 
B^{K, ni{F)) by YL\K, fie) with F^'/KT''^. Using LemmaOwe identify the quotient 
of H^(ir,Aff(X,/i£)) by Y[^{K,nt) with U^^- The top row of g3]) is then seen to be 
the quotient of the long exact sequence coming from the top row of (14. 8p by the images 
of H^(if, /i^). A completely formal diagram chase shows that the rows of (14 .90 have 
isomorphic kernels (so that kk is the kernel of the top row as well). 

Recall that the image of $ is contained in %k which is a coset of V^k (see (13. 3 p and 
([33D). We define Tk and J"]^ to be their images in / F^^ under pr^. By (14. 9 p we 
have that 



d2A^) = 0} 



c{5e F^'/K^'F''^ 
c{5e F^'/K^'F''^ 

For £ = 3, it is relatively easy to show that all three sets are equal (Recall that in this 
case 82 = Np/k)- Since Tk is a coset of J-'k, we find that there exist constants c G 
and (3 G H2 such that 

(4.10) J^KC{6e F^'/K^'F''' : ^2(5) G PH^'} 

C{6e F^'/K'^F''' : Nf/k{5) G cK'''] . 

These constants can be computed as follows. The linear form [1 cuts out the divisor 
£[x]. Its norm evidently cuts out the divisor ^XIxgxN ~ ^7r*[0£;]. The model for 
C C P^^^ is given by the embedding corresponding to 7r*[0£;], so £7r*[0£;] is I times a 
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hyperplane section. If this hyperplane is defined by, say h G K[ui, . . . ,U(\, then, for 
some c G ^ we have a relation Npjxih) = ch^ in the homogeneous coordinate ring 
of C. Similarly 92([x]) = [y] from which it follows that there exists /3 G H2 such that 
^^2(^1) = the coordinate ring. 



4.3. Relation to the descent map. We now relate diagram (14.91) to the descent map 
of the previous section. 

Lemma 4.4. For any ^ G li\K, E[<^]), T(0 = C. 

Corollary 4.5. Covl^\C/K) is either empty or is a principal homogeneous space for 
T^^s: under the action of twisting. 

Remark 4.6. If is a number field and C is everywhere locally solvable, then it is 
possible to show that CoYl^\C/k) 7^ 0. This follows from the fact that any element 
in H^(fc, Aff (X, /i^)) which becomes trivial everywhere locally is itself trivial (c.f. [TT| 
Theorem 2.5]). 

Proof of Lemma 4-4 ■ Let ^ G }i^{K, E[(f]), and let ip : C E' be an isomorphism (de- 
fined over some extension of K) such that (p'otp = n. The class of —C in Cov'-'^ \E /K) = 
li^{K, E'[(p']) is represented by the cocycle Gk 3 a ^-^ ip — ijj"' E E'[(p']. The cup product 
— ^ C = —C U^' ^ is represented by the 2-cocycle 

Gk X Gk 3 (a, r) ^ e^/(V' - C) = e^iC, - ^) G /i^ . 

The value of the connecting homomorphism T on ^ is defined by choosing a lift of 
^ under (14. 2p to a cochain with values in Aff(X, /i^), and then taking its coboundary. 
So T(^) is represented by the coboundary of the 1-cochain Gk 3 cr ^ e^(^o-,^(-)) ^ 
AS{X,fj,e), which is the 2-cocycle 

T] : Gk y< Gk 3 ((x, r) ^ G /i^ . 

Using Galois equivariance of the Weil pairing and that is a 1-cocycle, this simplifies 
to 



This is same as the cup product computed above, which proves the lemma. □ 

Proof of corollary \4 -SI Recall that ll^{K, E[ip]) acts simply transitively on Cov^'^\C / K) 
by twisting. We need only show that this restricts to a transitive action of ~ ker(T) 
on CoYi^\C/K). Let D G Cov^'^\C/K) and ^ G R\K, E[ip]). After identifying all with 
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their images in Coy^^\E/K), the twist of by ^ is the class of -D + ^. For the cup 
products defining Cov^\c/K) we have 

The desired conclusion follows. □ 

Proposition 4.7. The descent map $ is affine: if {D,p) G Coy'^\C/K), ^ G ker(T) 
and {D^,p^) is the twist of {D,p) by ^, then 

$((D5,P5)) = <i>((Ap))-$o(0, 

where $o is the isomorphism in Iji4-4\ l- 

Corollary 4.8. The descent map $ is injective. If Cov^q\C / K) is nonempty, then its 
image is equal to T-Lk (which was defined in ^3.4\))- 



Proof of Proposition \4-'7\ Let ^ G ker(T), and fix models for {D, p) and {D^, p^) as genus 
one normal curves of degree i in P^^^. We can also fix equations for an isomorphism (of 
coverings) ip : ^ D defined over K, with the property that ip'^{Q) = ip{Q) + for 
all Q e and a G Gr- 

Choose linear forms {) and f)^ with coefficients in F defining the pull-backs of [x] G 
Div(C ®K F) by p and p^, respectively. For some A, G , necessarily representing 
the images of {D,p) and {D^, p^) under $, we have 

A ■ (91) = [ o p and A^ ■ di)^ = lo p^ 

in the coordinate rings of D ®x H and ®k H, respectively. Applying ip* to the first 
relation and comparing with the second gives 

A ■ d{i) o ip) = ■ di)^ 

in the coordinate ring of D^. Specializing to a point Q in D^{K) not lying above any 
X E X G C (i.e. so that both [)^ and i) oip are invertible at Q) we have 



x\Gk 



Note that ()^(Q) and f)('?/'(Q)) depend on a choice of homogeneous coordinates for Q, 
but that their ratio does not. This is G/^-invariant since A and A^ are in iJ^. Un- 
der the isomorphism {dF'')^'< / dF"" ~ H^(ir, Afr(X, p^)) implicit in ^f^Sr) 



corresponds to the class of the 1-cocycle 



?7 : Gk 9 (t I-)- 
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which a priori takes values in Aff(X, /i^) C ^e{F). We need to show that the image of 
this cocycle under the map induced by Aff(X, /i^) — )■ E[ip] is cohomologous to ^. For 
this we make use of the following commutative diagram. 

(4.11) Aff (X, ^,(F)c 



Here the left square is the same as in diagram (14. 8p . Since the horizontal maps are all 
injective, it will be enough to show that, for any a G Gk, the images of and ?7o- in 
the lower-right corner are equal. 

Using the fact that f) and f)^ are defined over H and rearranging, we have 

^{rm) \ ( HQ) \ 

Making use of the fact that ip'^lQ'^) = iplQ'^) + C,a we can rewrite this as 

A(^(Q) + + imn - HQ)))\ fHQ" + iQ- Qnr 



'^'^ V mQ)) J V HQ") 

By Lemma 14.31 this represents the image of 

+ imn - i^m - (q" - q) e m 

under the embedding given by the bottom row of (14. lip . But 

{^l;{Q'^)-^(Q))-(Q'^-Q) = OJ,, 

(see [281 X.3.5]) so the images of rj^ and in the lower right corner of (14.111) are equal. 
From this the proposition follows. □ 

Proof of corollary^ Note that CovJ'^^ (C/fsT) is a principal homogeneous space for 'hPj^ 
by corollary 14.51 The fact that $ is affine and that $o is an isomorphism imply that 
$ is injective and that its image is a coset of "H^s:- is a coset of "H^c containing the 
image of $, so the two must be equal. □ 

Proposition 4.9. The following diagram is commutative. 

Pic°(C)^ Pic°(C)^^ ^^^=^^^= E'{K) 



n% ^ ker(T)^ R\K, E[cp]) 

Here 5tn is the connecting homomorphism in the Kummer sequence. 
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Proof of Proposition \4 ■ ^ Let P G Pic°(C) C E'{K) and choose a representative d G 
Div(C) whose support is disjoint from X. Write ci as a difference d = di—d2 of effective 
divisors and write each di as a sum di = X]j=i Qij of n = deg(di) = deg{d2) (possibly 

non-distinct) points on C. Now choose any {D,p) G CoyI)''\C / K) and a hnear form f) 
with coefficients in F defining the pull-back of [x]. For each Qij in the support of d, 
choose a point Rij G D such that p{Ri,j) = Qij- These choices are such that, as points 
on E', ' 

~ — {Qi,j ~ Qi',j') ' 

for any In particular, Lp (j2^=iiRi,j — R2,j)J = d. So the image of P under 

the connecting homomorphism is given by the cocycle 

(n n \ 

j=i j=i / 

On the other hand, the image of P under I is represented by 

The condition defining the image of {D,p) under the descent map is, in the coordinate 
ring of D ®k H, lo p = ^{{D, p)) ■ d\). Since deg((i) = 0, this gives 

Under the isomorphism {dF'')^'< / K"" dF"" ~ R\K, AS{X, pe))/K'' , 1{P) is sent to 
the class of the cocycle a i— ?■ a'^/a , where a G -F^ is any element such that da represents 

[(P). The argument above shows we may take a = ^11^=1 Hence, the image of 

P in }i^{K, AS{X, pe)) / is represented by the cocycle r] sending a G Gk to 




Note that both i) and i)^ are linear forms satisfying the hypothesis of Lemma 14.31 Ap- 
plying this lemma as was done in the proof of proposition 14.71 to each factor appearing. 
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we see that the image of rj^ in H^(_ft', E[(p\) is equal to the class of the cocycle 



n 



Gk 3 (T ^ 



This is the same as the image under the connecting homomorphism, so the diagram 



The purpose of this section is to prove the following theorem. 

Theorem 5.1. Given A G T-Lk we can explicitly compute a set of i{i — 3)/2 quadrics 
(when i = 3, a ternary cubic) with coefficients in K which define a genus one normal 
curve Da of degree i in and a tuple pA of homogeneous forms of degree i which 
define a morphism — t- C C P^~^ giving the structure of a ip-covering of G . 
Moreover, the class of {Da, Pa) H^s in Cov^q\G/K) and its image under $ is A. 

The construction gives an explicit inverse to the descent map, and hence the following 
corollary. This removes the assumption Coy^q\G /K) 7^ in corollary 14. 8[ 

Corollary 5.2. The descent map $ gives an isomorphism of affine spaces $ : CovJ^^C/iT) ~ 



Let fx be the projective space over K whose coordinates correspond to the elements 
of X. We have an identification of (F \ {0}) /iT^ and Fx{K). The action of on (F \ 
{0})/K^ by multiplication corresponds to an action of on Fx by i^-automorphisms. 

Given A & , we can define a scheme D^ C Px x C by the rule 

{z, (mi : ■ ■ ■ : ui)) G Da ^ 3 a G such that l{ui, . . . ,Ui) = aAd{z) . 

This condition is invariant under scaling and the action of the Galois group, so D^ 
is defined over K. Moreover, the action of a G F^ on Fx induces a i^'-isomorphism 
Dd{a)A — -Da- Thus D^ only depends on the class of A in / K^dF^ . Define 
Da C Fx to be the image of D^ under the projection of Fx x G onto the first factor. 
Then D^ is the graph of a morphism pA : D^ — > G . 

The following lemma gives some justification for this construction. 

Lemma 5.3. If {Da, Pa) is a (p-covering of G , then its class lies in Cov'"q\G / K) and 
its image under $ is represented by A. 

Proof. For the first statement it is enough to show that the pull back of any a; G X 
is a hyperplane section of Da (see Lemma l2.7p . For this we can work geometrically. 
Over K, li splits as {lx)xex where Ix defines the hyperosculating plane to G at x. The 
condition defining Da gives Ix = aAxZ^, for x & X. From this it is clear that the fiber 
above x G X is cut out by the hyperplane Zx = 0. This proves the first statement. 



commutes. 



□ 



5. Inverse of the descent map 
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It also shows that 2; is a hnear form defining the pullback of [x] under pA- From the 
defining equation we see that lo = aAd{z), from which it follows that ^((Da, tta)) 
is represented by A. □ 



X 



To make the construction more explicit, we can proceed as follows. Suppose A 
(AijAs) E F"" X H2 ~ H"". The equation = Aad{z), where a e K 

z E splits as a pair of equations 

(5.1) {i{ui,...,ui) = Aiaz^ l2{ui, . . . ,Ui) = A2ad2{z) , 

over F and H2, respectively. In terms of a basis for F over K, z^ and d2{z) can be 
written as forms of degree i in K[zi, Zi]. 

When i = 3, writing li{ui, . . . ,ue) = A\az^ in terms of this basis and comparing 
coefficients yields 3 equations, linear in the Wj, cubic in Zj and with coefficients in K. 
Together with I2 = aA2d2{^z^ we have 4 equations of this form (recall H2 = K when 
£ = 3). Using linear algebra this system of equations reduces to 

Ml = Pl(^l,^2,^3), 
U2 = P2{zi,Z2,Z3), 
U3 = p3izi,Z2,Z3), 
= f{Zi,Z2,Z3), 

where all forms on the right hand side are of degree 3. Then is the plane cubic with 
homogeneous ideal generated by / and the pi define a map to (which contains C). 

When i > 5 the same approach will yield homogeneous forms of degree i. This is 
perfectly acceptable for defining p^, however the model for should be defined as an 
intersection of quadrics (see [IHl 1.1.3]). Since F is a subalgebra of H2 we may consider 
both equations in fIS.ip as being defined over H2. There is a quadratic form Q{z) with 
coefficients in H2 such that d2{z) = z^~'^Q{z) (this is clear from the definition of Y2 and 
^2). To get something homogeneous we take the ratio of the two equations in fIS.ip and 
multiply through by z'^. This gives 

(5.2) = 

h{u) Ai 

Writing this out in a basis for H2 over K (extending that for F over K used above) 
yields l)/2 quadrics in z whose coefficients are i^-rational rational functions on C. 
Elimination will result in some number of quadrics in z with coefficients in K. Then Dj\ 
is the subscheme of ~ P^~^ whose homogeneous ideal is generated by these quadrics, 
and Pa is obtained as above. 

Remark 5.4. From this explicit construction it is not a priori clear that pA maps Z^a 
to C. That this is so will become evident in the proof of Theorem 15.11 below. 

Lemma 5.5. Elimination of Ui, . . . ,ue from the i{£ — l)/2 quadrics above results in 
i{i — 3)/2 linearly independent quadrics with coefficients in K . 
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Proof. To prove this we may work geometrically. Over K the linear form [ splits as 
^ = ([{x,P))) where x E X, P E E'[ip']/{±1} and l(x,P) cuts out the divisor (£ — 2)[x] + 
[x + P] + [x — P] on C. For distinct (x, P) we have distinct rational functions 

G{x,p) = ^ f^iC)^ , 

l(a;,0) 

with divisors [x + P] + [x — P] — 2[x]. In particular, for any x, the functions G(^x,p) he 
in the Riemann-Roch space £(2[x]), which has dimension 2. If we fix Pq G \ {0}, 

then for any P G ^ {li^"^ > ^^"^ ap,bp G -S' such that 

The functions Gi^x,p) have distinct divisors, so ap, 6p ^ 0, for P 7^ Pq. 

In an appropriate basis for F over the homogeneous equation ( ]5.2p corresponds 
to a system of equations 

G{x,P) ■ zl = ^(x,P)/ ^(xfi) ■ Zx+pZx-P , 

parametrized by (x, P) G X x {1^1}°"^ • Using the relations above to eliminate the 
G(x,p) we obtain a set of quadrics 

^{=^,Po) , 1 2 _ '^(x,P) 

Q'P~Z ■ Zx+P^-,Zx-Pq + Op ■ — — ■ Zx+pZx-P , 

^(x,0) ^{x,0) 

parametrized by P G ^ ^'^ and with coefficients in K. The coefficients here are 

all nonzero elements of so the quadrics are linearly independent. Thus, we have a 
set of #X ■ # ^.^JH^O|±i^j _ _ 3^y'2 independent quadrics as required. □ 

It remains to prove that (-Da, Pa) is in fact a (/^-covering of C. 

Proof of Theorem 15. it Fix an isomorphism (over K) of C and E' and use it to identify 
the two. We may arrange for this isomorphism to identify X and E'[(p']. Let us compute 
the image under the descent map of the yj-covering in given hy E ^ E' = 

C. For this we should embed E in P^~^ in such a way that the pull back of any flex point 
is a hyperplane section. This amounts to finding a basis for the Riemann-Roch space 
of the divisor (y9*[0£;'], which has dimension C. = jj^E'[ip']. For each x G choose a 

function Gx G k(-E') with div{Gx) = — ip*^E']- The standard construction of the 
V?-Weil pairing shows that such functions exist. Nondegeneracy of the pairing shows 
that the Gx are linearly independent, and hence form a basis for £(</)* [0 £;/]). 

This gives an embedding g : E 3 Q {Gx{Q))x£E'[^'] & ^x- It is evident that the 
pull back of any x G E'[(p'] is the hyperplane section of g{E) cut out by Zx = 0. Let 
Q e E\ E[e]. Then (/?(Q) ^ E'[(f'], so [((/?(Q))_is invertible in H. The imageof (P, y?) 
under the descent map is represented by the A G such that l{ip{Q)) = Ad{g{Q)). 
This implies that A represents a class in "H^. 
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Let P^~^ be as defined by the construction above. It is clear that Pa° 9 = ^ 

on E \ E[i], and that the image of this open subscheme under g is contained in D^. 
Since is complete, this is then true on all of E. Thus g{E) C and Pa ° 9 = V- 
By definition g{E) is a genus one normal curve of degree i. Its homogeneous coordinate 
ring is generated by a ^-vector space of quadrics of dimension i{i — 3)/2 (resp. a 
ternary cubic for i = 3). We already have such collection of quadrics (resp. a ternary 
cubic) which vanish on D^, so g{E) = D^. This proves the theorem for A. 

Now let A G be a representative for some class in T-Lkj and let P^^^ be 

as given by the construction. Since A represents a class in "H^, the ratio A/ A lies in 
dF^ . Therefore D/^ and are ^-isomorphic as a P^~^-schemes. It follows that p^. 
gives Da the structure of a y9-covering of C C P^~^. The theorem then follows from 
Lemma 15. 3[ □ 

6. Computing the Selmer Set 

We now specialize to the case that K = k is a number field. The material of the 
preceding sections can be applied both to k and to any completion k^. To objects defined 
over k we attach subscripts v to denote the corresponding object over ky obtained by 
extension of scalars. We assume C e Sel^'^'^E/k) and is embedded in P using the 
linear system corresponding to the pull back of [0^;] under the covering map. Since C 
is everywhere locally solvable, the natural map Pic(C) — )■ Pic(C*)*^'= is an isomorphism. 
We assume that the constants c e /c^ and (3 e H2 (defined by fl4.10p ) are integral 
and that all coefficients involved in the linear form [ are likewise integral. This can be 
achieved by scaling. 

Functoriality of I gives rise to the following commutative diagram. 



Pic(C) 



n rcs^ 



npic(c®, ky)^ — -Hi^ 

We make identifications Pic^(C ®k K) = C{ky) and Pic*^(C ®k = E'{ky). 
Definition 6.1. We define the algebraic ip-Selmer set of C to be 

Sellrj(C^/'^) = {Aenk ■■ for all primes v, res„(A) G l(C(A;„))} • 
We define the algebraic ip-Selmer group of E' to be 

Seli^j(EVfc) = {A G : for all primes v, res,(A) G KE\K))] . 

Proposition 14.91 shows that Sel^'^j (£"//;;) is isomorphic to the 9?-Selmer group of E' . 
The 99-Selmer set of C is an affine space for the y9-Selmer group of E' . It is also evident 
that Sel^'^j(C//c) is an affine space over Sel^'^j (i?'//;;) (i.e. a coset inside /k^dF^). 
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Propositions 13.41 14.71 and Corollary 14.81 show that the descent map gives an isomorphism 
of affine spaces 

<|.:Sel(-)(CA)^Seli^(CA). 

To perform a yj-descent on C it thus suffices to compute the algebraic yj-Selmer set. 
Using the method of section [5l one can then construct explicit models for the elements 
of the (y9-Selmer set as genus one normal curves of degree £ in P^~^. An algorithm for 
computing the algebraic Selmer set is given in Theorem 16.21 below. For its statement 
we require the following notation. 

Let F' denote the splitting field of X. Over this field li splits as {lx)xex- We say that 
[i has bad reduction at a prime of A; if there a prime w of F' above v and some x G X 
such that Ix = mod w. 

Let S be the finite set of primes of k consisting of those primes such that 

(1) V \ £ ■ c, or 

(2) C has bad reduction at v, or 

(3) li has bad reduction at v, or 

(4) V ramifies in F. 

Theorem 6.2. The following algorithm returns a set of representatives in for the 
algebraic ip-Selmer set of C . 

Compute Sel^^j (C/A;) : 

(1) Compute a finite subsetVi C F^ of representatives for the subgroup of F^ /k^ F^^ 
which is unramified outside S . 

(2) Compute the finite set 

V2:={iS,e)eV,xH^ : 02(6) = /3e'} . 

(3) For each prime v & S compute 

:= l.{C{k,)) C {{6,6) e F^^ X : 82(6) = f3e' } /k^dF:: . 

(4) Return the set 

V3 := {{5,e) G V2 : res^(5,£:) G G^, for all v e S } . 

For the most part the steps in this algorithm are typical of explicit descents. The 
first step can be achieved by computing certain S'-unit and class group information in 
F (see for example [24, Proposition 12.8]). The second step requires only extracting 
i-th roots in H2 ■ By fl4.10p is contained in the set 

{(6,6) G F: X : d2iS) = (3e' } /k^dF^ . 

By Hensel's lemma this set is finite and 1^ : C{ky) is locally constant. The sizes 

of the local images in step (3) can be determined a priori. To compute in practice 
we compute the images of random /c„-points (given up to sufficient precision) until their 
images generate a sufficiently large space. For further details we refer the reader to the 
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discussion of the analogous situations considered in |26l [TT]. The fourth step can be 
reduced to hnear algebra over F^. 

The proof of Theorem 16.21 will make use of the next few lemmas. 

Lemma 6.3. Suppose v is a prime of k that does not divide i and does not ramify in 
F. Then an element ofH^^ is unramified if and only if its image in is unramified. 

Proof. Let A;"'' be the maximal unramified extension of k^. Recall that the kernel of the 
map pr^ : "H^nr — )• J^jinr is denoted by Hk^r. If v is unramified in F and does not divide i, 
then all points of X are defined over A;"''. This follows from the criterion of Neron-Ogg- 
Shafarevich. We claim that Kk^r is then trivial. Indeed, since the action of the inertia 
group on X is trivial, K^nr reduces to the quotient of d2^ii{F^) by d2{f^i{Fy) / fii) . But 
lieiyF^,) and fi£{Fy)/fie have the same image since fie C kerc?2. 
Now consider the following diagram with exact rows 

— — -ni ^J'l -0 

By definition, the unramified subgroups are the kernels of these vertical maps. So it 
will suffice to show that T-L^nr — ?■ J-'°nr is injective. This follows from exactness since, as 
we have just seen, the lower-left term is trivial. □ 

Lemma 6.4. Ifv\£, and i does not divide the product of the Tamagawa numbers of E 
and E' at v, then [^{E'iky)) C "H^^ C Yi^{k^,, E[lp\) is equal to the unramified subgroup, 

Kr{k,E[f]) := ker {}l\k.,, E[p]) ^ }^\k:^ , E[^])) . 

Proof. Proposition 14.91 shows that {y{E'{ky)) equals the image of the connecting homo- 
morphism E'{ky) — )■ H^(fc„, which is itself equal to the unramified subgroup by 

[25| Lemma 3.1] and [261 Lemma 3.1]. □ 

Lemma 6.5. Forv ^ S, ly{C{ky)) andpi^ i^{C{k^)) are unramified in /k^dF^ and 
F^/k^F^^, respectively. 

Proof. Let v ^ S and let F' denote the splitting field of X. By Lemma [6.31 it suffices to 
prove the statement for pr^ ly{C{ky)). Let P G C{ky) \X be given by primitive integral 
coordinates. Then pr^^ ^v{P) = h{P) ^ ■ The algebra F^ splits as a product of finite 
extensions of ky. Since f f £ it is enough to show that ii{P) has valuation divisible by 
i in each factor. If Ky^ is some factor, we have an unramified tower of field extensions 
ky C Kw C F^, where tnlti^lf is some prime of F'. Over F', li splits as a tuple of linear 
forms Ix with coefficients in F', each defining the hyperosculating plane to C at a: G X. 
Since the extensions are unramified it will suffice to show that 

ordn,([a;(P)) = mod £ , for each x G X. 
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For this one makes use of the norm condition corresponding to the constant c G . 
We have 

5^ord„(t,(P))=ord„ ( J]t,(P)| =ord„(iV^/^(ti(P))) = ord„(c)=0 mod£. 

It will suffice to show that at most one summand can be nonzero, for then all must 
be divisible by £. By assumption the special fiber of (an integral model for) C 
is nonsingular, so the points x mod to are distinct. Each linear form t^. reduces mod 
to to define the hyperosculating plane to the special fiber at the point x mod ro. So 
ordn,(la:(P)) > if and only if P = a; mod to. Since the x E X have distinct reductions, 
this can occur for at most one x. □ 

Proposition 6.6. 

( ) f A ^ 17 ^ unramified outside S, \ 

[ \fv e S , les^iA) e ^C{k^)) j 

Proof. Let Z be the set in the proposition. It is clear from the preceding lemmas that 
Sel[^g{C/k) is contained in Z. For the other containment, let A G Z and v ^ S. We 
need to show that reSt,(A) G ly{C{ky)). For any A' = lv{Q) G ly{C{ky)), the ratio A/A' 
is unramified and lies in "H^^. It follows from Lemma [6.41 that A/A' = tt,(P) for some 
P G E'iky). Since the descent map is affine we have A = [^,((5 + P) G [y{C{ky)). □ 

Proof of Theorem W.^ Suppose A G V3. Step (4) ensures that for all v E S, res„(A) G 
lyC{ky). Moreover, since S is not empty this also ensures that A represents a class in T-Lk 
(cf. Lemma [3l6l) . By Lemma 16^ step (1) ensures that A is unramified outside S. Propo- 
sition's] then shows that A represents a class in Se\^^g{C/k). This shows that the algo- 
rithm computes a subset of the algebraic <^-Selmer set. The reverse containment follows 
from the fact (see (KWf ) that Tik is a subset of { (^, G P^ x : 82(6) = f3e^} /k'^dF 

□ 

6.1. The Fake Selmer Set. In practice it is often easier to compute the image of 
the algebraic Selmer set under the projection pr^ : j^^Qpy. 'WW^- Recall that the 
composition pr^^ o[ : Pic(C) — )■ ^xpxi is given by li. 

Definition 6.7. We define the fake ip-Selmer set of C to be 

Sel/aie(C/^) = {5 G J'fe : for all primes v, iesy{5) G li,„(C(A;^))} . 

The projection pr^^ induces a map 

pr,:Seli^)(C/fc)->Selfl(C/fc). 

In general this can fail to be injective or surjective (it is possible to construct examples 
of both phenomena). Nevertheless, the fake Selmer set often yields useful information 



SECOND DESCENT AND BSD 



27 



on the genuine Selmer set. For example, if the fake Selmer set is empty, then so is the 
Selmer set. 

From (14.101) it follows that the fake yj-Selmer set is contained in the sets 



In particular, if either of these sets is empty, then so is the yj-Selmer set of C. 



We have implemented the algorithm of Theorem 16.21 in the computer algebra system 
Magma [3j, for £ = 3, 5, 7 and k = Q. This was used for all computations below. 

7.1. Proof of Theorem 11.11 As described in the introduction, the proof of Theorem 
11.11 has been reduced to determination of ^-primary parts of III for the 11 isogeny 
classes in table [H For each the situation is similar. All are of rank 0, the mod-£ 
Galois representation is reducible, and the optimal curve E has a Q-rational ^-torsion 
point. The quotient by the cyclic subgroup generated by this point gives an £-isogeny 
(f : E ^ E' . It is a well known result of Cassels [6j that the £-part of the BSD conjecture 
is invariant under isogeny, so it suffices to determine the order of III(£'/Q)[£]. The order 
predicted by the conjecture is 1, while that of III(£"/Q) is 

Since -E'(Q) ^ Z/£Z one can perform ^p- and yj'-descents on E' and E more or less 
by hand using the method described in [El E]. One gets that Se\^'^\E' /Q) = while 
Se\^'^'\E/Q) is presented 3-dimensional subgroup of Q^/Q^^. This establishes that 
UI{E'/Q)[i] ~ Z/iZ X Z/iZ, however it is not sufficient to show that UI{E/Q)[i] = 
or, what is equivalent, that UI{E' /Q)[e^] = m{E' /Q)[£]. 

The description in fl3\ ITi] also gives models for the elements of UI[E' /Q)[ip'] as 
everywhere locally solvable genus one normal curves of degree i. A second (/^-descent 
on any of the nontrivial elements C gives Sel(^)(C/Q) =0 (in all 11 cases it was in fact 
sufficient to compute fake Selmer sets). From this it follows that ip{in.{E /Q)[i]) = 
and hence that that III(£^/Q)[^] = 0. Two explicit examples are given below; the 
computations for the others are similar. 




6 is unramified outside S, 
Vf G 5, res^(5) G h,v{C{ky)) 





6 is unramified outside 5*, 




7. Examples 



Remark 7.1. Since the order of UI{E' /Q)[Lp']/ip{'m{E/Q)[i]) must be a square, it 
suffices to do the second yj-descent on just one nontrivial element of UI{E' /Q)[(p']. 
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7.2. The pair (1950y, 5). Let E denote the elhptic curve labeled 1950yl in Cremona's 
database. The Mordell-Weil group is cyclic of order 5. Denote the corresponding 
isogeny hj ip : E ^ E'. The method for ip and (/^'-descents described in [131 [E] 
gives Se\^'^\E'/Q) = and an explicit isomorphism of Sel^*^ \E/Q) with the subgroup 
of Q^/Q^^ generated by 2, 3 and 13. The image of E{Q) under the connecting homo- 
morphism is generated by 2 ■ 3 ■ 13^. This implies that the Fs-dimensions of III(ii^/Q)[(y9] 
and UI{E' /Q)[(p'] are and 2, respectively. 

The classes of 2^^ modulo Q^^ are represented by the genus one normal curve: 



C 



U3U5 



Qui 



U2U4 — Qui 











> C 



At5 



2uiU2 
4uiM5 
13721^4 — QU2U3 + 2^5 
13^1^3 + U2 — I2M4U5 

2Qul + U2U5 — 3QU3U4 

This has good reduction outside the primes dividing 1950. The action of E'[(p' 
on C is, after identifying Q G E'[{p'] with ^ G /is, given by 

Q + {xi : X2 : X3 : : x^) = (xi : (^2 ■ ("^x^ : (^2:4 : C^^Xg) . 

The quotient by this action gives C the structure of a (/^'-covering of E (well defined 
up to composition with a translation by a point in E{Q) ^ Z/5Z). To prove that 
III(£^/Q)[5] = it suffices to show that the yj-Selmer set of C is empty. 

The quotient evidently identifies the points lying on any given coordinate hyperplane. 
Let F = Q{6), where 6' is a 5-th root of 2. The hyperplane {xi = 0} intersects C 
transversely at the point P = (0 : — 6^^'^ : —O"^ : 6 : Q) and at each of its GQ-conjugates. 
These 5 points form a torsor X under E'[ip'] = fi^. They are fiex points; the linear form 

(1 = 1871mi + 33O0M2 + 1224^^3 + 1224^^M4 + 330^^M5 

defines a hyperplane meeting C at P with multiplicity 5. 

One can check that Np/q{Ii) = modulo the homogeneous ideal of C, so the constant 
c G corresponding to our choice for li is 1. [1 has good reduction at all primes, so 
the fake Selmer set is contained in the set 

P^ 6 is unramified outside {2, 3, 5, 13} 

r,x5 



V 



6 G 



; ^x5 



and Np/q{6) G 



P has class number 1, so to compute V we only need generators of a subgroup of the 
{2, 3, 5, 13}-unit group of P of finite index prime to 5. This can be achieved through 
standard algorithms. One finds that \^ is a cyclic group of order 5, generated by the 
unit a = + 6'^ -1. 

To cut this down any further we need to make use of the local conditions at the 
primes in {2, 3, 5, 13}. First we consider p = 3. E has split multiplicative reduction and 
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the Tamagawa numbers of E and E' at 3 satisfy cz{E) / cz{E') = 5. This imphes that 
E'{Q3)/(p{E{Q3)) = (see for example [221 Section 3]). It follows that the local image 
ti,3(C(Q3)) C F^/Q^F^^ consists of a single element. The Fg-point (2 : 1 : 1 : 2 : 1) on 
C is nonsingular. So it lifts to a Qs-point in the 3-adic neighborhood 



U={2 + 0(3) : 1 + 0(3) : 1 + 0(3) : 2 + 0(3) : 1 + 0(3)) C P^(Q3) • 



One can check that h{2, 1, 1,2, 1) is a unit in F^ (i.e. has valuation in each factor 
of F3). Hence for every P E U, the class of ti(-P) in F^/F^^ is the same. A direct 
computation shows that [i(2, 1, 1, 2, 1) = ^ 1 mod Q^F^^. It follows that the fake 
Selmer set must be contained in {a^} C V. 

We now consider the local condition at p = 5. We have dimE'{Q5)/(p{E{Q^)) = 1. 
As above we find neighborhoods 



■= (59 + 0(5^) : 65 + 0(5^) : 14 + 0(5=^) : 49 + 0(5^) : 1 + 0(5=^)) C P^(Q5) , 
U2 := (109 + 0(5^) : 10 + 0(5^) : 29 + 0(5^) : 89 + 0(5^) : 1 + 0(5^)) C P^(Q5) , 



which contain points in 0(Q5). Evaluating [1 at the coordinates of any point in either 
neighborhood gives a unit in F5. Here F5/Q5 is a totally ramified field extension, so the 
class of a unit modulo 5-th powers is determined by it class modulo 5'^. Hence, [i_5 is con- 
stant on these neighborhoods. If a = [1,5(59, 65, 14, 49, 1) and b = Ii,5(109, 10, 29, 89, 1), 
then Ii,5(0(Q5)) is the affine line in F^ /Q^ F^^ consisting of classes represented by 
some a™" • 6" with m + n mod 5 = 1. One can check that res5(a^) does not lie on this 
line. This shows that the fake yj-Selmer set is empty. 

Specifically, this shows that there exists no (/^-covering of C that is locally solvable 
outside {2,13} (since we didn't use the local conditions there). From Lemma 12731 and 
remark 123] it follows that in(£'/Q)[5] = as expected. 



7.3. The pair (1230/c, 7). Let E be the curve labeled 1230/cl in Cremona's Database. 
As above E{Q) is cyclic of order 7. We let ip : E ^ E' by the quotient of E by E{Q). 
Fisher's method for 7-isogeny descent gives an explicit isomorphism of the <^'-Selmer 
group of E with the subgroup of Q^/Q^'' generated by {2,3,5}. Up to sign, the class 
in in(£"/Q) corresponding 9Q^'' is represented by the curve: 
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buf — Su^Uq + U2M7 
lOul — + 

6^2 + — 

+ 2uiU3 — U^Uq 

6ul + U2U4 — 5miM5 

3m| + 3M2M4 — 5-U6W7 
m| + M3M5 - IOM2M6 

3m| + — 5OM1M7 

3^5 + U^Uq — IOM3M7 

50'Ui-U2 — 3(7,5 — QuiUe 
5uiU4 — 6uq — 
5^2% - uj- U^U-j 
3U2U5 — UiUq — 

3U3U4 — 6uiUq — 2uj 

The first (/9-descent shows that this curve violates the Hasse principle. The second 
93-descent shows that it does not lift to an element of order 7 in III(£'/Q). 

Any coordinate hyperplane intersects C in 7 distinct flexes. The most convenient to 
work with are those given by P = (0 : : — : —6^^ : 69'^ : 39 : —9) defined over 
F = Q{9), where ^ is a 7-th root of 9. The 7 possible choices correspond to the 7 
distinct lifts of the class represented by C to the (^'-Selmer group. 

The hyperplane defined by 

[1 = 250111iii-209538^ii2+102354^2,^3-29225^V+29225^V-34118^^'U6+23282^V , 

meets C at P with multiplicity 7. Modulo the homogeneous ideal of C we have 
Np/q{Ii) = (41~^-Ui)'', so again we may take c = 1. We then compute the class group 
of F (it is trivial) and generators for a finite, and prime to 7, index subgroup of the 
{2, 3, 5, 7, 41}-unit group of F. Using these we determine representatives in F^ for the 
subset of the unramified outside {2, 3, 5, 7, 41}-subgroup ofF^/Q^F^^ consisting of ele- 
ments whose norm is a 7-th power. This gives a 5-dimensional space which contains the 
fake (/?-Selmer set. As in the previous example, the local conditions for p G {2, 3, 5, 7, 41} 
can then be used to reduce this to the empty set, establishing that the 93-Selmer set of 
C is empty as well. 

7.4. A full 5-descent. Consider the elliptic curve E/Q with Weierstrass equation 
y'^ + xy + y^x^ + x'^ - 12241995603x + 781027222459441 . 



















> c 
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An L-function computation shows that E has rank 1. Solving for Reg(i?(Q))-7^III(£'/Q) 
in the conjectural formula yields 242.0138.... This suggests that any point of infinite 
order in E{Q) will be very large. We do first and second 5-isogeny descents to compute 
a generating set for E{Q). 

E{Q) contains the point P = (-49091 : 35573052 : 1) of order 5. The quotient of E 
by the subgroup generated by P gives a 5-isogeny ip : E ^ E'. The cp- and 9?'-Selmer 
groups of E' and E have dimensions and 2, respectively. This confirms the fact that 
E and E' have rank 1 and that there is no nontrivial 5-torsion in III for either curve. 
The genus one normal curve 



163miU5 — U2U4 — U3 
U1U3 + U2 — 32QU4U5 



C : < 



Ul + 467'U2'U5 — 2usU4 

U1U2 — 467^3^5 — 2u\ 
U1U4 — U2U3 + 76121^1 











> C 



together with the appropriate covering map C ^ E, represents the image of a generator 
of the free part of E{Q) under the connecting homomorphism E{Q) — )■ Se\^'^ \E/Q). 
We know C (Q) is nonempty, but a naive search still reveals no Q-points. A yj-descent on 
C computes that the algebraic yj-Selmer set has size 1 (this is in agreement with the fact 
that y9-Selmer group of E' is trivial). Using the method of section [S] we construct the 
corresponding (y9-covering. To ensure the coefficients of our model are manageable we use 
the minimization and reduction algorithms for genus one normal curves implemented 
in Magma by Fisher [TB]. What we obtain is the curve D C with defining equations 

52122 — 22123 + 32124 + 42125 — — 82223 + 82224 — 42225 — 52324 + 2325 + 62I — 22425 + 2I = , 

42122 + 42123 + 32125 — 42I — 72223 — 2224 — 423 — 82325 + 82I — 2425 + 42I = , 

32122 — IO2123 + 2124 + 32125 — 32^ + 62223 — 62224 + 32225 — 62325 — 2I — 32425 + 425 = , 

52122 + 22123 + 32124 + 32125 - 2I + 42223 + 32224 — 82225 + 32324 - 32325 + 22I - 62425 - 22I = , 

42i + 92122 - 2123 — 52124 + 22125 - 9z2 - 2223 — 2224 + 92225 - 32325 — 2zl + 32425 — IO2I = , 



together with a degree 5 covering map D ^ C . In a couple minutes one finds the 
rational point 



Q = (8576638489 : 4495315592 : 7115424631 : -2573365369 : 8465644680) G D{Q) 
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As expected the coordinates of the image Tr{Q) G C(Q) have approximately 5 times as 
many digits; they are 

ui = -47781179424001250276101034444306427793974640994508803, 
U2 = -36805769809432466564750059701585425584354450037869765 , 
Us = 11567437127698252390861515883750795832342708671332291 , 
«4 = 24705602119472788155755723752744787614294729359169672, 
Ms = 99572421720530424479069471725920845332991347451591. 

The image of Q under the composition D ^ C ^ E has infinite order. One can 
check directly that the canonical height of the poiniO is 242.0138... and that it, together 
with the torsion point P, generates -E(Q). Its image under ip generates -E"(Q) (since 
E'{Q)/ip{E{Q)) C Sel^'^^(E7Q) = 0). In particular, the smallest nontrivial point on E' 
has canonical height 5 ■ 242.0138... = 1210.069... . So it would have been no easier to 
work on the isogenous curve. 

Finding the generator via a 4-descent on E would likely have required searching for 
points on a 4-covering up to the impractical naive height of 10^^. One could potentially 
improve this by extending to either an 8- or a 12-descent (both implemented in Magma). 
The later requires class and unit group computations in a number field of degree 8 and 
relatively large discriminant. While not entirely infeasible this would take a significant 
amount of time, even without requiring that the computations be performed rigorously. 
The 8-descent runs into problems factorizing a 1600 digit integer which plays much the 
same role as our constant c G Q^. By way of contrast, our computation was complete 
in about one minute (the majority of which was spent searching for points on D). 
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